4b738a1943a95da09d38f70bd5791fe3d5999a2bcf3c120d098bfd7884b6ecdc

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.6MB
Sample260504-plpxfaft5j
SHA256 4b738a1943a95da09d38f70bd5791fe3d5999a2bcf3c120d098bfd7884b6ecdc
MD5 db9cc06b104b2e58ac6d54da403d4ed5
SHA1 084dc10db97a3f7b02de9f669ed72d07745a9d6a
SHA512 d42459b4b74706717c0cedfecb23b868f5b3dc886fbda507c1ac524b8c1989355cf4f7e272f167f844525de155e39f4e17a2184495b5e6665d65ebbf1431400b
SSDEEP 12288:wHPrGxzQ9TA1ubv6IQ3E45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:wHzGxms3Yz7KEMdX6keYnAcerP
TLSH
T10475121076C1C4B3E86309316AB0CA70593EFE711F644AEB6388675A5F742D28D39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5076	alg.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
3456	fxssvc.exe
4228	elevation_service.exe
5932	elevation_service.exe
5852	maintenanceservice.exe
5912	msdtc.exe
6124	OSE.EXE
3048	PerceptionSimulationService.exe
3352	perfhost.exe
5772	locator.exe
4076	SensorDataService.exe
4356	snmptrap.exe
4852	spectrum.exe
5688	ssh-agent.exe
1520	TieringEngineService.exe
1320	AgentService.exe
2028	vds.exe
4560	vssvc.exe
5488	wbengine.exe
5636	WmiApSrv.exe
652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de8ab4ccc682cdf5.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d606ffdc2dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bb401fdc2dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe
1960	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	3456	fxssvc.exe
Token: SeRestorePrivilege	1520	TieringEngineService.exe
Token: SeManageVolumePrivilege	1520	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1320	AgentService.exe
Token: SeBackupPrivilege	4560	vssvc.exe
Token: SeRestorePrivilege	4560	vssvc.exe
Token: SeAuditPrivilege	4560	vssvc.exe
Token: SeBackupPrivilege	5488	wbengine.exe
Token: SeRestorePrivilege	5488	wbengine.exe
Token: SeSecurityPrivilege	5488	wbengine.exe
Token: 33	652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	652	SearchIndexer.exe
Token: SeDebugPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4324	2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1960	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 5960	652	SearchIndexer.exe	104
PID 652 wrote to memory of 1776	652	SearchIndexer.exe	105
PID 652 wrote to memory of 3060	652	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_db9cc06b104b2e58ac6d54da403d4ed5_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2588

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5852

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5912

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3080

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2800 2808 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1776
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2592 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 60d7488675962176c0f89f605666762b14906d11d76cad6e15f6188b83ea0cc4
MD5 ec2ec1e4154985a39add0ee71ea60055
SHA1 6a743dc2ddb4be21a8d48675469582d9bd0a9455
SHA512 cdbafcb1d4c2851da8e3c2d9b60ef4f3a1048ed08e133f274f1b74bf002df8a728d64182d09c59761aecc3fe3963dd9e7478f770f1909b4b6c722b28c2eb8869
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBYPKEnSG:w3q6HjB4YPKES
TLSH
T1E1D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0214095b8dccc8ab0a3988f321ce4a40905f5cf82f41804923cf8c02ad9d4d3a
MD5 e1f0eabfa2049d9098551c4e5876c185
SHA1 528b1d2b0651704371c156fa2d9b263a7f5f2bef
SHA512 c6131e6e4e290bc2cf4c974687807478fe5e0ca676bf6aa532b6dc218dadf92e185d184accb77b5e5b80b3d2d8ad5dbf557cc7de5c8341421399587830dce28f
SSDEEP 12288:p1XLsswWkxy2lRq2czAr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkX:nXYfDtczAUYz7KEMdX6keYnAceru
TLSH
T1E385012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 cc6abb5dc0d3641c639122039bf7284208ffc584c1362920f35e62cedb5e3881
MD5 b00d942410420382757f195c25e1bfcb
SHA1 80b5d2e1ace29a51abd822b8a376ead8ec5a6871
SHA512 b081150b6b25ddba5b8c39b730684dbde353591b57d7a2816b2bde9056b6b0b6395348b7bdbee7b764ef7c8e437f38502e7d8b49442268c486cabcd7b62952a5
SSDEEP 24576:w0Le5ji0hmx3rM5Yz7KEMdX6keYnAcerO:wPji0AZOYPKEnSG
TLSH
T154A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f270d3ae2dc5b060a74138c224fa8fd8353f62cf97662448ffeb502589cd054
MD5 48dcac7549f8b715b537ce4bbeb713ed
SHA1 a4af43238bc1c6c096cbfcf1af47823c2ed6a399
SHA512 876edb44a8d9bc168522f3bce4fe07dd5083d2a5cb7c269625f1759599f61f1badf928c9db85ee5280991e2b979e1c2c12fa6b4e92bb684aa448988ad65628c4
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyu/Yz7KEMdX6keYnAcerS:M/ezSC6vUzPvxHjyqYPKEnSG
TLSH
T1CA756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03e6ec730429287e9f09281fe1c66d5075cf5ce6fe276151c6e61bb79609bc39
MD5 9ae3db4f2c51027977fd7df3bd5e8293
SHA1 f59e3fc5674038a34491b8c032ad13e69bda93db
SHA512 074d7ab3893f887019fa36bded80f835da96eb8068f39ae795d897bf25cce6c92b685d89632b336f037b35a2010bb202ce01b9ab7a6ea42f405215287bb31acc
SSDEEP 24576:8VbqPb88hv/l+6oYz7KEMdX6keYnAcerY:8VO88hXl+1YPKEnSG
TLSH
T1E7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 7286d6e6f9b9b68e138c30749c9b4ae44735af3d3329615afd3617fe4e30f924
MD5 a92e261fa13a9a124c3ddf67eff8c109
SHA1 d16968148e13d41d34ed9d3ae6a9042abfba35ce
SHA512 77e1f6b85fe30f144a748d6f889056f18ac1b17b63412ca9f794d8af56021a47efe63420b39c496f58d30b4b81f2e25c7ea76a96c9490ee8048cd6b4ac109d3a
SSDEEP 12288:pXO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkH:pXdYz7KEMdX6keYnAcerK
TLSH
T1206523048B1A89D2F85F067BFFF5894085375DC62E8C97A1C94CFA4293BE222C51679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c8c4bbf22edeaafb32af97d143652809d4be8001511ebe14fbf0cc843b486a7f
MD5 0ca4f8fb6a2919a5c37a492c984792e2
SHA1 e509687cd417d55d2a2ebed39f234b729e3c540e
SHA512 70b989a17ad9987d15c0ea223223e8aff95479f45ceb0db7badc9bc0b3a16b77d18c399985b850195809d60f470f647936538690807457b60000c5c08f8f73f7
SSDEEP 12288:peBNUbTVO86UP45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:pJIUgYz7KEMdX6keYnAcern
TLSH
T12E85CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 76d01b18c7697973a7e3e8d7d495e0a843dfbec8446d4600ed8954249fee91b4
MD5 580db81a65a92de222dc7d1c942f1a79
SHA1 65b551d40423b2f75fb5286aace34f5d6e3b0d8c
SHA512 4f254aa7eabc21be2aa9a03d7da900f454059de82cd9eb475cea587899376b21fee9a149f21b4d47876c377bb0c842bde2e90d2c3dbae0731eea9fd34902edc7
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:AQvGAdlCEL8c/yRNw5CvYPKES
TLSH
T166267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ec41712bec4199b169b380420821b60860d0e39ad259f6a9b3c0d9dacd404a4f
MD5 3b3d59c3ea327a49175af0660cbd3f7b
SHA1 4e016a5d3eac686934d8c5272f1e26e7e3f3015e
SHA512 02c50e41670b381d620cc468ff42fc4166ea4ba275d57bb81d6d84f3040279f7bf18c1cb82817a3acd06d49812e464e271a2d14192a366df6ca4ec6806123e60
SSDEEP 12288:zAwSfxL/2Dc3BDLLmt0LDQewsAjx45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkH:skewsAj+Yz7KEMdX6keYnAcerW
TLSH
T19395E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1180afb936a32a3f4e01aef0adad6684c942e995c828bd85411e31ca879230bf
MD5 b85d681c601a464ff0d653094541445e
SHA1 9ccefa70fc166b48f78e24a27c062ff0af4ccaec
SHA512 fb79884dddd3e6a346a04ec437b743f85fdc5283adc774777cd42a1f1462a35fb98fd726d8a2f690b720e47a3aad309f389913781aa545c3380f01234759cb13
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGcKZ:eUEtQevvqc2W1cpV2EI32Gn
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7f5671ac33e4e46f792a55249d9776335d7fcdb39f096d583768548749338f3f
MD5 eda2b29b849a205a0eadd6159fc257fd
SHA1 60f5d5b497e6171c927302525a5bdc3ace60e07e
SHA512 e23e1fdd0168e4fef280474f65c428b6b22b42fec7623c808b04ca26738f1c8c0b88f910f788da236ddf620dc1d2636c2a81c11d66daed75c898cee598f17413
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zeYPKEnSG:SoqtVjnmLYPKES
TLSH
T1BBD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 64d89ec76f524af17bb64d149b73f8da1a084319442b550645f667f166301f64
MD5 80906b9f20baa5db5301080350035ede
SHA1 d1bc15896a3bab92bc2795df565b57ae21682dca
SHA512 d6c24d660bd9fe2ba5f5bda1292eed062366db8fd7db24af00a2cb8e03ef6d14abad0d65082729f02339597234d4b03a47a3d0ee70cbb8c447293f0815b023c1
SSDEEP 24576:bAhGLJIFoiwtA5l7S53rYz7KEMdX6keYnAcer/:bAMyFoiq57YPKEnSG
TLSH
T1F7359E80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5d1854c3015857d2a1c4c9c48ec93d3a50bdb8085d886c0b851d83d56e5cae96
MD5 890b6f81e34c4c51bccd6fc62a49835d
SHA1 a98fd160197f56214182df59f139274a20b1f840
SHA512 facd9fc29bc24321beabdbe698306e4a2b8a33afeb59a375fa828c6d0f57888af744150e8a378066a7d9be150b5721eb378a5ac4efa4ba90f7a8c9e5eb1e1956
SSDEEP 12288:Dmw5HEjsChNzBFgl0WDm+Cc45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:CwuSOWKYz7KEMdX6keYnAcerX
TLSH
T15785F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 81661daad278b4f6dfa17bdb0cacf574db07a3ce0f27963d41c5eae83a0eed76
MD5 161989274d94f4a7d48d8b6fd746b1d7
SHA1 8a2d33fcbc3392430476cedd6cd278cf0b12b9c8
SHA512 65ac3a1830ef1d70b07729062f694c266673c3ec142a2b4784d88f7720ca8a007af387bf20a759fa3af7203771b99d9cd991f0475c90b4983bcebbad69bd72fe
SSDEEP 12288:WjZ1Iyh45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:CZuxYz7KEMdX6keYnAcerA
TLSH
T10775124927A820F2F497423EEEF14A01D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3341f4105108f674a76e643ed2bde3a502ee9449ec127ad6e9e1c4d5384d4fec
MD5 7db3173f1d03a2ccf3044c06b32f98d0
SHA1 6bc0e6e4c023c69cc80e435bc1597416fcedaa49
SHA512 b1143bf78efad314c39acbebb4e188e77f07b840f65ee60a0676011b5185240bfe41441c66097576f33a5d2c897df9609106f2f7d9aa08ef64759535eb743f10
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:JQRQyi36YOcPQLvw2gAf+PN3sYPKES
TLSH
T157667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 588d6814a08d7b6761d921e77a858251c3d2175524ca8e1fb30b436f39fe59fd
MD5 958d27fb7507f9f1ac0748b38e9afb70
SHA1 e21e67589c736247c289ae0dea84464a22814b89
SHA512 2d677b58c807da1569e47e7d1abc5fc436836738002d8dc3fccb6d47c321002a0c4c917abcaf67c4e013c0b50f06e6c3d584502ce5ce8a9271f34a25891d070e
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:5QRQyi36YOcPQLvw2gAf+PN3sYPKES
TLSH
T1C9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ecee4d5436ef56eda0cebce8440af777030b63fc9eb717c2d18b1901cba7dab
MD5 e5557d4fff0430ea4971f9fdc9175174
SHA1 32d980896bfe487a972f3975c46211876757a96d
SHA512 867b995966649cc36b577264bebb165fb655b051de238de8dca4c8d179d9db8f19dde9ac3ee4024d6bf4c25642c29fee5a9919050dd0a902d5d6d6377da24b07
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BYz7KEMdX6keYnw:t68Qg55nhheWu7PNU3/OYPKEnSG
TLSH
T1CAB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c2a705f169086a528a9f18d6fd6569d3e0b96d15381bff80d74a54cf314f6fd
MD5 d147bd55cba5796d66bfc926bbd7f61e
SHA1 8b72ccd5ffa22bb835c4e71e534163a3497202c6
SHA512 f8b5c933c66fd964e9386c5f6e407688da46c2d686560f0aa11ee7f5f8b2892214827365579d1929a922918998276e23dea13f6a03b7a6e1f609270b9c79268e
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:ay5112gYy5azzVvL69nLKnhZdYPKES
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1e419b33d2381bc07885f9effdb6a54ae2724c8eeb15b1a024af37643ca9379d
MD5 42d89504e59f4485f9fcc7cd8875033d
SHA1 99be84908e1b832056bbdcfe2a8947fbe4028f47
SHA512 4140ff20cedb1cef2f40202c34cb3be6cedc5e441fb1153c8a17ef0612bd12ef2edf73f03620f9990832bb0ede8d84944c5a0871fef1db588fdf272ec31d091d
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkYPKEnSG:9u6JmVxd2dkYPKES
TLSH
T1B3D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db62165cadce15a300b55512930b4a36b6dbde8c98aea6480ee427629d5e5eb7
MD5 2a5480536721a53773dbd250f6b0ef71
SHA1 f4fd5dd9b1a0b38dc0b49b39563b5507d06066b7
SHA512 f81be47dbdb26ee0ef4519eba8bde244fec9de8bdc5aa860ef0bbbbccdd6d12d4d5ea1f42d45cff1be5959848bd17ef6c9894c14f2ee28ee6baaba880347228d
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xAYPKEnSG:DmifPbRLYPKES
TLSH
T144B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c3becd99f106880926154cd5ea56f4ecdfa7fb3d0dda83c9453204b3c2190ed2
MD5 8fb8356f44ab4a38c8dbf90bb57b3b2e
SHA1 b8afc1255050df636282ba1401a3c73202eb7adf
SHA512 9edb0192f50a0a8ca5c3de51dc88d2db82f5b2da4e9fa0ccaecd098817554f599b7ccab50db3ba8f565738816c8910620dcca2ee34652a71a1c1955b9cda711a
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqxYPKEnSG:Y5dKTi61xYPKES
TLSH
T1A3C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1e98462b34bbcb66b633ab8992dd3e740734414d4105afec6e5d3ddbf1e4ca90
MD5 7627959cdc4ec799cd0f8c39ca9a28e8
SHA1 00aba2bbc000b83ebd1756b95b321aa259a2e08e
SHA512 9f69f7469ca4c49fc466691ffd41eb4d04ec3c25f83e4b53f9d6beb7125a5271825c214028f311ee58bc57b2ba3a46f0f08978abdf9b7b64e3f9207f84ef3ce4
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wUYPKEnSG:AX2iyphXYPKES
TLSH
T1CF95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 035d03d4526aacaeed0ff9e6e1bd5d9cde02c5a81363d5ebce042ae477a63481
MD5 eda55e19e9d3a38d011856a1c215ffd3
SHA1 f6286fc3096b0445e994b367b7b2c2a922d52017
SHA512 ba48f5274d1b1847882df21d44a44c902845c3f591d4d3dfce85eef21e7d37d6b4c2d601c2639e83c868e2213edfeb662ed8ea96bf550aa07bc352017196278a
SSDEEP 12288:mm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkA:m1Yz7KEMdX6keYnAcert
TLSH
T13F6523048A5B8AD2F84A467BFBF54540C53A6ECB3B8C83A1DD4DF50293FF6224505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 0d03b34acba8e103e38f7abed0626ea47284bb585da030fa37a29efe8b6170ab
MD5 5017c2cce1be156065a72281588c8094
SHA1 7cbf4686c1ddb6cd22a93a1c205ab95cf2c577ae
SHA512 fc62a612a89990685c1390ef235fb615f68df716e56cfec5762bc21306b406e27e35ef8bbaa83e962594ac49a9dfe8946b0ce3a160a9c509e18aca85f33bf5ee
SSDEEP 12288:PN45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:PSYz7KEMdX6keYnAcerR
TLSH
T11A652304891B8AD2F84A467BFBB54540C53A6ECB3B8C83A6DD4DF50293FE7324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 42c6cb83d4fafdc640346c5d3de132061e72f70bb54cedf27a45d8afbdf9084b
MD5 17827c001594520bc682721d8fee6d69
SHA1 58610fbaab4ad723781002ffb8654270b1d85ba0
SHA512 6c1c17d021a16e09fbbeb9d87e849c1e483ee158cf7766b5513380c4c1f232b5787f974f0c7599bec8a9036440a27709ac3356063256ffc888d2c109453f5bb5
SSDEEP 12288:sn45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:s4Yz7KEMdX6keYnAcerB
TLSH
T1F7652304891B8AC2F84A467BFBB54540C93A6ECB3B8C93A6DD4DF50293FF62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 00679cac1ae984b5b72c6d0028924b5bb5c2dc6c4aa317076fc9b55d37136af4
MD5 84f0d9163f6f6f7ea50e6e5ad6fe8117
SHA1 e9dfe8cec9ae2ff3ba300c09500ae9609ed0f985
SHA512 2f131b9e9e0992ff907ddbbcab2b08f08d772b57c06faa0b3144ae78d027e3d9697890f56b1c676be53d65075369f01fa59716ce40ee5fa1edd9d4801465117d
SSDEEP 12288:5VQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:HYz7KEMdX6keYnAcerE
TLSH
T1277523044B5B45C2F85BC27BFEB18500D6767DC63B2893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 d79b9a9a3cb1f37fc0721c5332dd549efb1dc2543ab9753a37292e913bd4d235
MD5 a3cf700a4a097128741c5eadc85557cf
SHA1 41e3e6236f2a86a2cc9426642c9e2e435be12ac5
SHA512 9a81f091c0223a5915649ddfbfd2ccc73ddc0686b11b986ab868f3c61bf5406842a47e7b98140ca4b27146193e4a069935caaeaf39253ca0077c2e2028d871f0
SSDEEP 12288:X445Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:XTYz7KEMdX6keYnAcer/
TLSH
T118652304891B8AC2F84A467BFBA54540C93A6ECB3B8C93A1DD4DF50293FF72245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 9bbe2add8bffd9766de564d29d02c46233ce83f1601a70db3eb55b218d67a7d2
MD5 f268d4fc74b28d54b94e7432c6e39cbf
SHA1 3964f24ed12d5af32465103f8d316a129ecee03d
SHA512 b8485b98c51e88fc992883ea7ac8a8c0c1fe18a542605c024f740051edb7d3ed263b94c3919460b63c1e3803c62da557986ccf85b83040d451d92745f07e052d
SSDEEP 12288:gp45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:g2Yz7KEMdX6keYnAcers
TLSH
T13D652304891B8AD2F84A467BFBB54540C53A6ECB3B8C83A6DD4DF50293FE7324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 bc012fb26b51fa4c7215a08bc501cc526322293323d79829a93f851d0a621a78
MD5 5009fa687824c3a1496bb6a72c238067
SHA1 d0d425d61d91aef860bad8dae9d123224ed18c2e
SHA512 b23ae7d87f3eb0890276705538764da3a157943df98b9269081e4255871dd94f197488b18c5feaa8fcd618bfd0d432b4ab81f3eb57fd223ac2cc4423c5f05b73
SSDEEP 12288:J145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:JaYz7KEMdX6keYnAcer6
TLSH
T1266523048D1B8AD2F84A427BFBA44540C53A6ECB3B8C83A6DD4DF54293FF6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2482dda40c56813d7e0dc0b14f8535177f9deefaea19c1dfb6b8f85d8f9d05b3
MD5 012b6e179b8d69e51c4b1d6f7fdb57b0
SHA1 06e41bc9e756d43aca9a13e3910d1ceafd0973bc
SHA512 73a75395753af2fdcfb968c8f50c17ca58a162dc988f36ca7bdc45df7221ba1f72654c24367c6f3463e6dc5d920c909de16b64983397f432af543b2413b44374
SSDEEP 12288:kiZwbHzzFEoS2cPvyt45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:HZMTzFVSOyYz7KEMdX6keYnAcert
TLSH
T1EF850194B3500CF4EC67823ECD658906D6B27C5A1B60C65F07A836675F773A10C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 8ec9b9d3fa0ef2210affdac984f1b5a0e16269a25043525fd80f059166afe22a
MD5 360fdb68fbd788e5a068947d71c22a9f
SHA1 1fbab7c498a733674ca8c895bef274014777aa7b
SHA512 68574c2904ed27cd239b80bf18bcfad4043aba52279e957b68e60cea666438b83658772370579b469f8894ab0caecacc1eacc28548d3a16c3de18613bcbae1a7
SSDEEP 12288:Ha45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:HhYz7KEMdX6keYnAcero
TLSH
T13D652304891B8AD2F84A467BFBA54540C93A6ECB3B8C93E2DD4DF50293FF722450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 24f8948a11b5502e3ac4db74fd4c7f1fe54de829b1a657ee4704a9f92401a567
MD5 6ae18219c6e14544a191733843dead84
SHA1 b77b45574aaaddd793b09c8fe3952255d8e829de
SHA512 8d4c848c109f304587b4ac286968d78576b06650240dc76f85cb5d01503eba48245554cfaced27590020264cfd5c7534381c70fdd9fd82169b0787eb765aeb47
SSDEEP 12288:c+45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:cNYz7KEMdX6keYnAcerI
TLSH
T197652304895B8AD2F84A427BFBA54540C93A6ECB3B8C93E2DD4DF50293FE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7f4928b8e947b011a9e804abcf2013cb5ec0243f3a77c707867b978eb8be7b7f
MD5 d44e0b04b463436e42c82c59a2dd5a7a
SHA1 8317076b573872773b000cc7a9191b0057af0047
SHA512 055bbea7c838e6616513b1f623bdd9dd218b682c7652e835421051aff4c895e955802a76108c6e21ab3cc7d0ac3408a6481c8f7b599d8cc02c8619cc1d950943
SSDEEP 12288:lyPz5L8h45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:szyuYz7KEMdX6keYnAcerG
TLSH
T19C75120767A630F5E0278239D9A20A01F77278761B248BAF579447732F7B3A15D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5320c075d3f1022de17a17054b1b32e2939d10d19c32831c2a45a832ed8bd7f3
MD5 2c8af2262d8537537ba5b0c476fc0bef
SHA1 89283d5bc6d6102b1d3d04f5ab87c6370c4b2bc3
SHA512 daf19c6355c1165d0a0a289385cbc7f5bc8aa41bd071a357ef176991ee3a07053a516d04fc7277d56ac79f1829c40bcb6b04d0f4e6e569211d4d3536b3166116
SSDEEP 12288:ia45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:ihYz7KEMdX6keYnAceru
TLSH
T1F6652304891B8AD2F84A467BFBA54540C93A6ECB3B8C93E2DD4DF50293FF632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 1d613de320fc8caf2e44222cfcc0b1aa6b000b3624a3bded0a24e2605e32f364
MD5 f2088b4287983829514aa2e8299487fb
SHA1 eadfa67a7f51035e0234778043895021eebb9d61
SHA512 c7a800d36c32d24338707ac579f2d85795bbd996066f241714e5e42a1cb52dc91bb9fd19de83fc8d3e3cf77e759ac7367edd6d873811ba14e89f7c3144bd9ed8
SSDEEP 12288:2a45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:2hYz7KEMdX6keYnAcero
TLSH
T1A3652304891B8AD2F84A467BFBA54540C93A6ECB3B8C93E2DD4DF50293FF632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bac5920ef0396a07f5d73a6052b67d691d77048cd7054d43d5888511008ebf81
MD5 3f44127c1185287340120fcdb84d5dfb
SHA1 e2b5513c8a43b76e300a4a294d2b9b3f9ff70ad8
SHA512 69789d4106b04d58282da8413c0e77831f751bec864a411d9de9f7cb3b9e20ad994e61c55f8947f725ad20b85baa5e37d8087bee8d18de20420e14e10773aaf9
SSDEEP 24576:eCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA8Yz7KEMdX6keYnAcerN:eCUxPTY+8Wg2lIL8lrIUJLWwTYPKEnSG
TLSH
T17D65BE1DA3EC0896D4BB81358A518A06EB32782E1B32D6CF1160C37D6F67EE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 cd15c993b20afd6447919aff91cb9dd8bc81ecf5510aeddf42f57302db9990f8
MD5 70eca740471eea2f86c047d690af9b42
SHA1 fb37a7b00dd068603ee51ac597c1cf13cc95ddd0
SHA512 85cbcc48b6211c0d27a8f49477e99c7ef255a99a5d2031204efb456ad20f86f095b559fab9c2c417bbfcb78e7a5ceb25176cc717ae4ed6a0b58cf84b33c3b573
SSDEEP 12288:+zsfq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk/:JxYz7KEMdX6keYnAcerq
TLSH
T16F750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 11b30aa1583470cae58c55bdee01d4b1d9a366e236acf6a3c2ca8733dc7bb45e
MD5 1d6f8e2e974430ae210dcedb298eb2c6
SHA1 89c5d72456d8ea1cd1c0ab0bcd77a7bd3ee82bf5
SHA512 34585b28e7dccffad7b55b0ebab0225697c321110cfbd330ef85ff6627fb12fe59e61077d30f42186ac4de61512782af031108f8537b642648655b243fb3b4c1
SSDEEP 12288:4H45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:4YYz7KEMdX6keYnAcer4
TLSH
T19A7523048B5E8DC2F86E4677BAB58520853E7DCA2F4882D3E80CB642937E6E14D3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bdb5325ca8041222ab52ff4691436202082e4f1b4b2148c553a650ad6b04d18a
MD5 38b8e9b3b526cf304edecaae807ae7c7
SHA1 9b4c2a248b7b3f09a7ba6ac48c8452dec2a076f9
SHA512 65465767bf7aad00ddb2655fdcc31e0e6942d63308eaaf5ad5bd2a3fa443965a40b4544e4c587acfd10e6b66ff541df41fa1e1e2e1a1fa2c47d696b03723330a
SSDEEP 24576:v8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCeYz7KEMdX6keYnAcer6:0RZwQCyiHiQEaaPnMZYPKEnSG
TLSH
T15785AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 ff19e1020a162bd1bcef5637c4f1cbe8c49bb41d76d364c73168cb0b5cb1f189
MD5 22054f332be0e60a048caf61a926c6a4
SHA1 99f63912222271496ef62ae57daa736c075ca9e9
SHA512 9da58062cc49822f4107f1a510ef89b3175fba8a26e5e727e32de8437e3f36d4912d8eb2fbc34ba0846cff4ac83504080b1e15fd093c10283848c93366c2419b
SSDEEP 12288:4bxA1U7K345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkc:4bxA1UGIYz7KEMdX6keYnAcer5
TLSH
T1FC75122E56AD18E1F47A923EAAE18101C3327C56272493EF5484C27A4F3BFE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 23707328fdc6fd101ed81222bc485e2dae2d02a336327b148e46ab73f0a2dc18
MD5 e37a954a8cda959fd05c0671f9549a7f
SHA1 167850e597efca19ca47274ab00abe2a23cd5412
SHA512 af3f0c08570ae4aaac3de665af6d1f7ab5ee6885f5e04f9da1d003dcf0f77f1b2f9dd6fbfc32aa53c5cfbd542d28bf1163dd60f5775ce35de15648e67a261ece
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrn7Yz7KEMdX6keYnAcerQ:BjRP0yHfVqzlAsrn7YPKEnSG
TLSH
T18545AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 1eb0ec4e2392abee43a610eae45170ab75c0e7d562e7a134e45076b80b945d70
MD5 2ad8ec6d5832bdafa5e9f9bb4290227d
SHA1 bfe6ab18f8815e103d2970abe85d85712e304a36
SHA512 f6d5742a9b66bbe387ab1351e439f4653620c3e525c30c00ea656f5d15334cb7f5541f4e688f2605420dbd21c06c82f6c7d8f356ec6768fc7bb724c006d27e34
SSDEEP 12288:NJ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:NWYz7KEMdX6keYnAcer6
TLSH
T1AD7523088A0B8AC2F85A467BFBA54500853A7EC63B5C43E3DC4DF54293BE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4a0151b9a532c6bc5bdf984c784c8cca28a405562687b1e8ba5a72f2c90732b7
MD5 8e3f43e1a2c037d08bc336e3158071ab
SHA1 e7216df865849b43456e6a9118118bcd3b1a30d9
SHA512 4f78cc10fb6e7e57bb4eac92b34beb0672d28dbefef0c52fe8a4c0c241495812b3b5b5e8af035e8b030c75275fd6be7aa06f196f3ae6b1d4a6223727216fbf1a
SSDEEP 12288:TObMA4LWO+vAYFTr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkn:8MLBUTUYz7KEMdX6keYnAcera
TLSH
T170950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9523eaa0887365f267702a6714e4e74a266d63134302b3316db8ae12b7683fe0
MD5 2fa0ab88250848da5967074458736e56
SHA1 2ca8965927fad0e1d75e3303f7e6631c5764fa7d
SHA512 6f8fa89ac88331ea75868c9f34003aaf585b6b33101de196abfe328f1cd60e0b23bef113b7efca1c70a4147261f9553426560556eb730af31eabf1a8664f8862
SSDEEP 12288:b70VmKIYNvUyBp245Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:kGYNHHYz7KEMdX6keYnAcerN
TLSH
T1D285F11E56AD0CE1E57B917ECAC28205F2737896171193DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4954b53c679fb428e56d91b575c464a9f88edb73685fe23092798367fd3f9742
MD5 6851163cab248464574955df43ca66ca
SHA1 6bba59f35946ca8d183edf727414e3c576c046a0
SHA512 17ad9d7d4faba8ba97afdeb3bcfeb065b4db33603da49591c20980641651314cc04cf3e1cdc904b3225d7312e501770de94f6cbcd8a27d2bc6332f02e73aa074
SSDEEP 24576:3nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKN:3nXoJJYH84VVS6AmEcJas+cHBjSSKHPB
TLSH
T1B865BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 afbafcc3bc36179c93d1a03ef1c6b86a555e612a5ea76074fc33585724add9fd
MD5 ce8bb364311da3474ad71e3e06b10b63
SHA1 ca06e6a150fa67dd9bd343635f0d322b9a909c8e
SHA512 6c70a011d29df59e99b71a227199be92e0d1c9e01b8aea27f7a2b51440f92a83edd37af2925be74c1345644558ed1b29fe85f394295363688c41966c4b61e10b
SSDEEP 24576:yv7Xbxd9Tuycf8M/TYlSuxwr2PC9Yz7KEMdX6keYnAcerb:yDLL9TuJ0M/TYW2P2YPKEnSG
TLSH
T1ED858D5EA2EC42D4E47BD6BD85B79046FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c5b343853787cef8547518025260cc972e7bd4a1f46dfc86cbf010422799a94a
MD5 df8e5771dcd1ffd7cb147af42dad808a
SHA1 abc4d710bb455716e7069ed0840bf1251a0a3645
SHA512 65e6f48f7f3339a51affaa6f3a7d970431f1399d0e9a19d67877ecc0d37cb65b2fe7e568ba613d14ddc3f939a13c1018375766e0b293591914bf8a0b4e5ef372
SSDEEP 24576:4egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wUYz7KEMdX6keYnAcerp:4ngOJOmPOHhUYPKEnSG
TLSH
T1B555CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 a8fa4634fa4be204e9fbaf22749b5c118139e36ee4e87a55298ba96ba9fc2704
MD5 69e0039876fec1a5fd549d099612aaea
SHA1 8da30858c393e36db19e78f3c265ed6174572c40
SHA512 360ac960fba9b333ad199bf94e70b18d314fc7888eb313bdf4e24a46f678cc36632015cc19f9f2dfcfa4b02fe843525e91e7ff95efa1789fabd50e3e989593de
SSDEEP 24576:7LJnJiTk3R3waE4JrO2Yz7KEMdX6keYnAcerQ:7LJnJK8R304lLYPKEnSG
TLSH
T16B85D02CD2A910E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4e3b8a60029f111e5669b38a95975e4cd23c99803cc0d80d942fb1dc1fe3164
MD5 dbb8f03056a48144c2b14c0daae7c197
SHA1 8d6d941776aa9d947aaa5cf6cec0e054500c587c
SHA512 94a0bdcfef40e2c95401b22d63d49b0c9a3453376b88f63780ff4fd57bb8dde0bc6ca8cd815ac873888e6ebf1ff762010f91d4a7409ee34b08792f4961039a85
SSDEEP 24576:pA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6psYz7KEMdX6keYnAcerT:+9GqCzDScAZmlvTcFg8Ph6aYPKEnSG
TLSH
T19C955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 dcd40a47981b2c9a719b7e786e47fa5ffae69be0e07f6ca786943cbc3ed2abca
MD5 98850106f5bd30148ec4a0dd9b74d5c8
SHA1 9f9e49d3c6ee50ffaf5d5dcc1a9f882fc55b20bf
SHA512 e9c6777d28d69f4f8db2661449e16a58794e4eb993791b673e33dadd32d9531210a6df35b8c6c727a800bd42a0665e7529550df677c38c238154d3aa1d3b4b81
SSDEEP 12288:nlYJeXm5nkEUuEb45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:nlYJeXm5jUuEEYz7KEMdX6keYnAcern
TLSH
T17075120C669D70E1F02E817EEAA14900D372F4A6274553FF85D4D1768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 6bfa08dd99e0fde06fe2d596974668475f15f0eb82682d09dd72af5230abb798
MD5 5a31a2fda7f0d02feb8dc92a30be3849
SHA1 2fc0d2b400b1dbf8487e7998e4de0667017b7fe6
SHA512 76daeb9a8c3c4ad3600f773b33a38078dde4d045b8407899df69afa0e0df328fa9b5a1808e1228d1f99f508d3d161a335886f2889b0560f10b9b743675f7dde8
SSDEEP 12288:ICu6kyg45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:IHtybYz7KEMdX6keYnAcerA
TLSH
T1D2751204579555D1F8BA0639EEB28150CB36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 925fac04f988dff75b8c30ca1aee5f840cd91ebcc2cfecff1335feb92bc96a2e
MD5 a8c18576956ee1535fb5fbd5ee19f95c
SHA1 e941e8e5604d82f0a871af24ceb277b05e38287c
SHA512 29cd9bc316cd2cb1464333b49a31dc065bc6913bcc7a0a3b9ddd050befb6676d4110bd8e76adb6f577167baeda4d37038bf0f95e4468730f355db5ab704dd865
SSDEEP 12288:iPr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkI:uUYz7KEMdX6keYnAcer1
TLSH
T17675230C461B59D2F80A467BFAB54540C13A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 41a6f4de214f8477f3d52e8e8e2642cc535c140d26d34111f668464f90eed5b2
MD5 9a3e7152fd8404396e17af3c49c81ffc
SHA1 687845bc5e2f2931206fab9119dc7f301343210f
SHA512 5edd37df1ef36d03d4a867e7dee769952b4af35d8eff2cd2b8ce12d6dd0352878cae1b23e075ddd03fef78d48b5f468623ae2d7ad2d44d1c6e9c4f16eae26663
SSDEEP 24576:DC+TyQIu93VAumZr7jmRYz7KEMdX6keYnAcerY:D/TfIq+YRYPKEnSG
TLSH
T189558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 4804ef59fdabfe411178bc932346efa5f4999689ced973c62893b6367d767d70
MD5 dd6d16deffa0010edef64eb803d204af
SHA1 f0bc2577a3012b8ec0db826e8a0306f01c42268c
SHA512 b9eccb4d0ccd462468eb159721c6f4ebca0a7c830d6caef700c2fbdc938db0d16e0f9d1b1ab0efc8f40fd920783540630dc2a69c0b26e0de4bc4983787006eef
SSDEEP 12288:lcyrWOstaa3kcsf45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:QLQikZwYz7KEMdX6keYnAcer1
TLSH
T14885F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 923e99ab091063a9d2085163f041928c6e5e39315f1d3895a30371c759a18b0c
MD5 53d611611e611ce708932760bc8cc124
SHA1 9049c9803fa42aca4d9cc099d0e4f11329dc4066
SHA512 3e65bd67a29a119bc2f8fe58efffd0cd3772e70574ee86dc21dfdff191768bf9a1cbadf12f40cbebbeda84d854f4d2464d8b3cba8425f78148a14a8d335e4962
SSDEEP 49152:spJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPbYPKEnSG:tpC7b4+80GTkCYPKES
TLSH
T12AA57D3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fa5bc4ee35af3da577065f26637321c30335b98fb98db12ea13673b63a1aea0f
MD5 66b79e90e0a1dca62a1b8e1c3af4b0fd
SHA1 ffd6be93167fa903ff635844a35c1e10feff3a48
SHA512 e976466ba6894dd5994ccbc52656f1f0500e7ca01ac39bf4cc6af68268eaa7ab8128bd6fdddf13dca0cdf909147b5599b00e983dff78747d933594a355e6ecde
SSDEEP 24576:DSAwJPE1IDAo+4Kt+l44135UQzYz7KEMdX6keYnAcer7:DqPCIo4Kol4/QzYPKEnSG
TLSH
T19F55AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 2bb6a7891fd9d3bdd61db92ee6935e427e5d13c066d424eac21ec9d982c3aee3
MD5 2aec89d1b757fe19ae9f4da6ae4e61e8
SHA1 f48578276fbd4e240d8e5118553e971df301cb80
SHA512 694868b890f2f0d6edddc375ae30022eb443ff614f9ec475b51da100272a36339a863da1c943bad9bcb7ac4d02490b48451e7f5ecf849017adc468347380bd16
SSDEEP 12288:iSsyLCFBoPLCRyg6NQ4tI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:myLXPLcL94tjYz7KEMdX6keYnAceru
TLSH
T1BF95E03ED66D08E0E47AC27DD6A38906F67238AD033166CB19A491751F6BFF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 c9d76a21d240ef953e46f050ebf1403ebeb81aad422fbcf780a9e9f32962440a
MD5 19b8ef9200b34615f5d6d26525371338
SHA1 1fbe8def2c4b190558934a0bf9acc4c74aaa089b
SHA512 d63a0bdb3801a3847fce5b16bc360cc65f4b42cf6bde6bf606a89ee54ed41ea9a2f9858c5aac5e7624c117646a9744df8ef96ca246661b69fd0da58d56d7de10
SSDEEP 12288:G9lyvj3IkxjbBzv45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:GWv8qjpAYz7KEMdX6keYnAcerx
TLSH
T16F85120D46A468D0F47A4234FA728121C172BCB7276896FFB4C8E5B74B3AAD1853EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-167-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/652-197-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/652-213-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/652-216-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/652-181-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/652-161-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/652-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1320-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1520-367-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1520-145-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/1776-402-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-371-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-396-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-398-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-408-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-399-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-401-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-407-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-395-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-403-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-406-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-405-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-394-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-400-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-390-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-391-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-392-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-393-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-404-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-397-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-372-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-373-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-374-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-375-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-376-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-386-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-385-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-384-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-383-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-382-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-381-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-380-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-379-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-378-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-377-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-387-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-388-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1776-389-0x0000012ADBDB0000-0x0000012ADBDC0000-memory.dmp

Download

memory/1960-124-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1960-21-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1960-15-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1960-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1960-23-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2028-214-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3048-94-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3048-96-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3048-287-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3048-88-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3352-99-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/3352-125-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/3352-104-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/3456-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3456-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4076-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4076-365-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4228-37-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4228-176-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4228-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4228-31-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4324-7-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/4324-3-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4324-76-0x0000000000400000-0x00000000005A2000-memory.dmp

Download

memory/4356-127-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/4560-177-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4852-115-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4852-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4852-329-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4852-121-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5076-11-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5076-123-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5488-178-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5636-180-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5688-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5688-139-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5688-366-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5688-140-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5772-129-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5852-67-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5852-61-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/5852-54-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5852-65-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/5852-55-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/5912-228-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5912-69-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5932-215-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5932-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5932-49-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/5932-43-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/6124-77-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6124-85-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/6124-260-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/6124-83-0x0000000000880000-0x00000000008E0000-memory.dmp

Download